Magento Polyshell — The Latest Magento Threat (APSB25-94)

Key Takeaways

• A critical unauthenticated RCE vulnerability (APSB25-94) dubbed 'PolyShell' affects Magento Open Source and Adobe Commerce.
• The flaw exists in the REST API's handling of 'cart item custom options', allowing unrestricted file uploads.
• Attackers bypass the ImageContentValidator by uploading polyglot files that appear as valid images but contain executable PHP code.
• Exploitation requires no authentication, only a Guest Cart ID and a product SKU.

Affected Systems

• Magento Open Source 2.4.8 and earlier
• Magento Open Source 2.4.9-alpha1
• Magento Open Source 2.4.9-alpha2
• Adobe Commerce 2.4.8 and earlier
• Adobe Commerce 2.4.9-alpha1
• Adobe Commerce 2.4.9-alpha2

Vulnerabilities (CVEs)

• APSB25-94

Attack Chain

An attacker obtains a Guest Cart ID and a product SKU from a target Magento store. They craft a polyglot file that contains both valid image headers and malicious PHP code. Using the Magento REST API, the attacker uploads this file via the 'cart item custom options' feature, embedding it as base64-encoded data in a file_info object. The server's ImageContentValidator approves the file based on MIME type and size, allowing the PHP payload to be saved and subsequently executed on the server.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: Yes
• Platforms: Akamai App & API Protector

Akamai has deployed an Adaptive Security Engine Rapid Rule (Rule ID 3000982) for App & API Protector customers to detect and block this attack.

Detection Engineering Assessment

EDR Visibility: Medium — EDR can detect the post-exploitation phase, such as the web server process spawning unexpected child processes or writing suspicious PHP files, but may not see the initial REST API payload. Network Visibility: High — The attack relies on specific REST API endpoints and JSON payloads containing base64-encoded polyglot files, which can be inspected by WAFs and network IDS. Detection Difficulty: Moderate — Detecting the polyglot file upload requires deep packet inspection or WAF capabilities that can analyze base64-encoded JSON payloads and identify PHP signatures within image files.

Required Log Sources

• Web Server Access Logs
• WAF Logs
• File Integrity Monitoring (FIM)

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Search for web server processes writing new PHP files to directories typically reserved for image uploads.	File Creation Events (EDR/FIM)	Execution/Persistence	Low
Look for HTTP POST requests to Magento REST API endpoints related to cart item custom options with unusually large base64-encoded payloads.	Web Access Logs/WAF Logs	Initial Access	Medium

Control Gaps

• Basic file upload validators checking only MIME type and file size (ImageContentValidator) fail to detect polyglot files.

Key Behavioral Indicators

• Unexpected PHP files in media/upload directories
• Web server processes spawning shell processes (cmd.exe, sh, bash)

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Apply Adobe patches for APSB25-94 immediately (upgrade to 2.4.9-alpha3 or applicable fixed version).
• Deploy WAF rules to inspect and block malicious payloads targeting Magento REST API cart item custom options.

Infrastructure Hardening

• Restrict execution of PHP scripts in directories intended for static media and file uploads.
• Implement strict file content validation that verifies file extensions match the actual file structure and content.

User Protection

• N/A

Security Awareness

• Educate development and security teams on the risks of polyglot files and the limitations of basic MIME type validation.

MITRE ATT&CK Mapping

• T1190 - Exploit Public-Facing Application
• T1505.003 - Server Software Component: Web Shell
• T1027 - Obfuscated Files or Information